Several photo, video and other media editing programs from software maker Corel contain DLL hijacking vulnerabilities that could allow attackers to execute malicious code on users’ computers.
According to vulnerability research firm Core Security, when opening a media file associated with one of the vulnerable Corel products, the product will also load a specifically named DLL (Dynamic Link Library) file into memory if it’s located in the same directory as the opened media file.
DLL files contain executable code so they can be used to install malware on computers.
The vulnerable products are CorelDRAW X7, Corel Photo-Paint X7, Corel PaintShop Pro X7, CorelCAD 2014, Corel Painter 2015, Corel PDF Fusion, Corel VideoStudio PRO X7 and Corel FastFlick, the Core Security researchers said in an advisory published Monday. Other versions might be affected too, but they haven’t been checked, they said.
In order to exploit these client-side vulnerabilities, an attacker could, for example, send a ZIP archive to a Corel user containing a media file associated with vulnerable Corel software and a specifically named malicious DLL. When the user opened the legitimate Corel file, the DLL would run as well.
In a corporate environment an attacker with access to a file sharing server could place the rogue DLL file alongside legitimate Corel files on an existing network share to infect workstations that use those files.
The specific name that the rogue DLL needs to have varies depending on the targeted Corel program. For example, wintab32.dll will work for CorelDRAW X7, Corel Photo-Paint X7, Corel PaintShop Pro X7, Corel Painter 2015 and Corel PDF Fusion, according to the Core researchers. For CorelCAD 2014, the file would have to be named FxManagedCommands_3.08_9.tx or TD_Mgd_3.08_9.dll.
DLL hijacking vulnerabilities, which result from an insecure DLL search path declaration in software programs, are not uncommon. The Stuxnet sabotage malware, which was used to attack Iran’s nuclear program, exploited a DLL hijacking vulnerability in Siemens’ SIMATIC STEP 7 and SIMATIC PCS 7 industrial automation software, among other flaws.
On its site, Corel claims that its software has over 100 million active users in over 75 countries. Many of those are probably businesses that use photo and video editing or computer-aided design (CAD) software in their operations.
Core Security claims that it contacted Corel about these vulnerabilities on Dec. 9, but that the company did not respond. As a result, it decided to make information about the flaws public.
“Corel is reviewing its products on a case-by-case basis to safeguard dynamic loading of DLL files, which is a common vulnerability in many Windows applications,” said Jessica Gould, senior communications manager for Corel, in an emailed statement Tuesday. “Corel makes frequent updates to our applications and these changes have been made a priority for the next update of any affected Corel product. We would like to assure our users that we are not aware of any exploits of this issue with our software.”
Updated at 2:18 PM with comment by Corel.